From c17dc6aa31aaa6e7f61bd25993be55354e428996 Mon Sep 17 00:00:00 2001
From: alecpl <alec@alec.pl>
Date: Sat, 20 Sep 2008 13:21:15 -0400
Subject: [PATCH] #1485385: fix missing close form tag
---
program/include/main.inc | 348 +++++++++++++++++++++++++++++++++------------------------
1 files changed, 201 insertions(+), 147 deletions(-)
diff --git a/program/include/main.inc b/program/include/main.inc
index a29978a..0eb8dc7 100644
--- a/program/include/main.inc
+++ b/program/include/main.inc
@@ -76,14 +76,14 @@
if (!empty($opt))
{
$db = &rcmail::get_instance()->db;
-
- if($db->db_provider=='pgsql') // just for sure
+
+ if ($db->db_provider=='pgsql')
{
$db->db_handle->setOption('disable_smart_seqname', true);
$db->db_handle->setOption('seqname_format', '%s');
- }
+ }
- return $CONFIG[$opt];
+ return $opt;
}
return $sequence;
@@ -128,18 +128,7 @@
function rcmail_url($action, $p=array(), $task=null)
{
$app = rcmail::get_instance();
-
- $qstring = '';
- $base = $app->comm_path;
-
- if ($task && in_array($task, rcmail::$main_tasks))
- $base = ereg_replace('_task=[a-z]+', '_task='.$task, $app->comm_path);
-
- if (is_array($p))
- foreach ($p as $key => $val)
- $qstring .= '&'.urlencode($key).'='.urlencode($val);
-
- return $base . ($action ? '&_action='.$action : '') . $qstring;
+ return $app->url((array)$p + array('_action' => $action, 'task' => $task));
}
@@ -223,6 +212,7 @@
return $str;
$aliases = array(
+ 'US-ASCII' => 'ISO-8859-1',
'UNKNOWN-8BIT' => 'ISO-8859-15',
'X-UNKNOWN' => 'ISO-8859-15',
'X-USER-DEFINED' => 'ISO-8859-15',
@@ -328,7 +318,7 @@
$is_iso_8859_1 = true;
}
if (!$enctype)
- $enctype = $GLOBALS['OUTPUT_TYPE'];
+ $enctype = $OUTPUT->type;
// encode for plaintext
if ($enctype=='text')
@@ -358,7 +348,7 @@
$str = strip_tags($str);
// avoid douple quotation of &
- $out = preg_replace('/&([a-z]{2,5}|#[0-9]{2,4});/', '&\\1;', strtr($str, $encode_arr));
+ $out = preg_replace('/&([A-Za-z]{2,6}|#[0-9]{2,4});/', '&\\1;', strtr($str, $encode_arr));
return $newlines ? nl2br($out) : $out;
}
@@ -473,9 +463,10 @@
* Remove all non-ascii and non-word chars
* except . and -
*/
-function asciiwords($str)
+function asciiwords($str, $css_id = false)
{
- return preg_replace('/[^a-z0-9._-]/i', '', $str);
+ $allowed = 'a-z0-9\_\-' . (!$css_id ? '\.' : '');
+ return preg_replace("/[^$allowed]/i", '', $str);
}
/**
@@ -607,7 +598,8 @@
$last_pos = 0;
// ignore the whole block if evil styles are detected
- if (stristr($source, 'expression') || stristr($source, 'behavior'))
+ $stripped = preg_replace('/[^a-z\(:]/', '', rcmail_xss_entitiy_decode($source));
+ if (preg_match('/expression|behavior|url\(|import/', $stripped))
return '';
// cut out all contents between { and }
@@ -640,6 +632,22 @@
return $styles;
}
+
+
+/**
+ * Decode escaped entities used by known XSS exploits.
+ * See http://downloads.securityfocus.com/vulnerabilities/exploits/26800.eml for examples
+ *
+ * @param string CSS content to decode
+ * @return string Decoded string
+ */
+function rcmail_xss_entitiy_decode($content)
+{
+ $out = html_entity_decode(html_entity_decode($content));
+ $out = preg_replace('/\\\([0-9a-f]{4})/ie', "chr(hexdec('\\1'))", $out);
+ $out = preg_replace('#/\*.*\*/#Um', '', $out);
+ return $out;
+}
/**
@@ -716,9 +724,13 @@
return '';
// get user's timezone
- $tz = $CONFIG['timezone'];
- if ($CONFIG['dst_active'])
- $tz++;
+ if ($CONFIG['timezone'] === 'auto')
+ $tz = isset($_SESSION['timezone']) ? $_SESSION['timezone'] : date('Z')/3600;
+ else {
+ $tz = $CONFIG['timezone'];
+ if ($CONFIG['dst_active'])
+ $tz++;
+ }
// convert time to user's timezone
$timestamp = $ts - date('Z', $ts) + ($tz * 3600);
@@ -764,6 +776,8 @@
// month name (long)
else if ($format{$i}=='F')
$out .= rcube_label('long'.strtolower(date('M', $timestamp)));
+ else if ($format{$i}=='x')
+ $out .= strftime('%x %X', $timestamp);
else
$out .= date($format{$i}, $timestamp);
}
@@ -800,19 +814,20 @@
*
* @param mixed Debug message or data
*/
-function console($msg)
+function console()
{
- if (!is_string($msg))
- $msg = var_export($msg, true);
+ $msg = array();
+ foreach (func_get_args() as $arg)
+ $msg[] = !is_string($arg) ? var_export($arg, true) : $arg;
if (!($GLOBALS['CONFIG']['debug_level'] & 4))
- write_log('console', $msg);
+ write_log('console', join(";\n", $msg));
else if ($GLOBALS['OUTPUT']->ajax_call)
- print "/*\n $msg \n*/\n";
+ print "/*\n " . join(";\n", $msg) . " \n*/\n";
else
{
print '<div style="background:#eee; border:1px solid #ccc; margin-bottom:3px; padding:6px"><pre>';
- print $msg;
+ print join(";<br/>\n", $msg);
print "</pre></div>\n";
}
}
@@ -836,16 +851,24 @@
date("d-M-Y H:i:s O", mktime()),
$line);
- if (empty($CONFIG['log_dir']))
- $CONFIG['log_dir'] = INSTALL_PATH.'logs';
+ if ($CONFIG['log_driver'] == 'syslog') {
+ if ($name == 'errors')
+ $prio = LOG_ERR;
+ else
+ $prio = LOG_INFO;
+ syslog($prio, $log_entry);
+ } else {
+ // log_driver == 'file' is assumed here
+ if (empty($CONFIG['log_dir']))
+ $CONFIG['log_dir'] = INSTALL_PATH.'logs';
- // try to open specific log file for writing
- if ($fp = @fopen($CONFIG['log_dir'].'/'.$name, 'a'))
- {
- fwrite($fp, $log_entry);
- fclose($fp);
+ // try to open specific log file for writing
+ if ($fp = @fopen($CONFIG['log_dir'].'/'.$name, 'a')) {
+ fwrite($fp, $log_entry);
+ fclose($fp);
}
}
+}
/**
@@ -883,68 +906,84 @@
* @return string HTML code for the gui object
*/
function rcmail_mailbox_list($attrib)
- {
- global $IMAP, $CONFIG, $OUTPUT, $COMM_PATH;
- static $s_added_script = FALSE;
+{
+ global $RCMAIL;
static $a_mailboxes;
+
+ $attrib += array('maxlength' => 100, 'relanames' => false);
// add some labels to client
rcube_add_label('purgefolderconfirm');
rcube_add_label('deletemessagesconfirm');
-// $mboxlist_start = rcube_timer();
-
$type = $attrib['type'] ? $attrib['type'] : 'ul';
- $add_attrib = $type=='select' ? array('style', 'class', 'id', 'name', 'onchange') :
- array('style', 'class', 'id');
-
+ unset($attrib['type']);
+
if ($type=='ul' && !$attrib['id'])
$attrib['id'] = 'rcmboxlist';
- // allow the following attributes to be added to the <ul> tag
- $attrib_str = create_attrib_string($attrib, $add_attrib);
-
- $out = '<' . $type . $attrib_str . ">\n";
-
- // add no-selection option
- if ($type=='select' && $attrib['noselection'])
- $out .= sprintf('<option value="0">%s</option>'."\n",
- rcube_label($attrib['noselection']));
-
// get mailbox list
- $mbox_name = $IMAP->get_mailbox_name();
+ $mbox_name = $RCMAIL->imap->get_mailbox_name();
// build the folders tree
- if (empty($a_mailboxes))
- {
+ if (empty($a_mailboxes)) {
// get mailbox list
- $a_folders = $IMAP->list_mailboxes();
- $delimiter = $IMAP->get_hierarchy_delimiter();
+ $a_folders = $RCMAIL->imap->list_mailboxes();
+ $delimiter = $RCMAIL->imap->get_hierarchy_delimiter();
$a_mailboxes = array();
-
-// rcube_print_time($mboxlist_start, 'list_mailboxes()');
foreach ($a_folders as $folder)
rcmail_build_folder_tree($a_mailboxes, $folder, $delimiter);
- }
-
-// var_dump($a_mailboxes);
-
- if ($type=='select')
- $out .= rcmail_render_folder_tree_select($a_mailboxes, $mbox_name, $attrib['maxlength']);
- else
- $out .= rcmail_render_folder_tree_html($a_mailboxes, $mbox_name, $attrib['maxlength']);
-
-// rcube_print_time($mboxlist_start, 'render_folder_tree()');
-
-
- if ($type=='ul')
- $OUTPUT->add_gui_object('mailboxlist', $attrib['id']);
-
- return $out . "</$type>";
}
+ if ($type=='select') {
+ $select = new html_select($attrib);
+
+ // add no-selection option
+ if ($attrib['noselection'])
+ $select->add(rcube_label($attrib['noselection']), '0');
+
+ rcmail_render_folder_tree_select($a_mailboxes, $mbox_name, $attrib['maxlength'], $select, $attrib['realnames']);
+ $out = $select->show();
+ }
+ else {
+ $js_mailboxlist = array();
+ $out = html::tag('ul', $attrib, rcmail_render_folder_tree_html($a_mailboxes, $mbox_name, $js_mailboxlist, $attrib), html::$common_attrib);
+
+ $RCMAIL->output->add_gui_object('mailboxlist', $attrib['id']);
+ $RCMAIL->output->set_env('mailboxes', $js_mailboxlist);
+ $RCMAIL->output->set_env('collapsed_folders', $RCMAIL->config->get('collapsed_folders'));
+ }
+ return $out;
+}
+
+
+/**
+ * Return the mailboxlist as html_select object
+ *
+ * @param array Named parameters
+ * @return object html_select HTML drop-down object
+ */
+function rcmail_mailbox_select($p = array())
+{
+ global $RCMAIL;
+
+ $p += array('maxlength' => 100, 'relanames' => false);
+ $a_mailboxes = array();
+
+ foreach ($RCMAIL->imap->list_mailboxes() as $folder)
+ rcmail_build_folder_tree($a_mailboxes, $folder, $RCMAIL->imap->get_hierarchy_delimiter());
+
+ $select = new html_select($p);
+
+ if ($p['noselection'])
+ $select->add($p['noselection'], '');
+
+ rcmail_render_folder_tree_select($a_mailboxes, $mbox, $p['maxlength'], $select, $p['realnames']);
+
+ return $select;
+}
/**
@@ -952,124 +991,143 @@
* @access private
*/
function rcmail_build_folder_tree(&$arrFolders, $folder, $delm='/', $path='')
- {
+{
$pos = strpos($folder, $delm);
- if ($pos !== false)
- {
+ if ($pos !== false) {
$subFolders = substr($folder, $pos+1);
$currentFolder = substr($folder, 0, $pos);
- }
- else
- {
+ $virtual = !isset($arrFolders[$currentFolder]);
+ }
+ else {
$subFolders = false;
$currentFolder = $folder;
- }
+ $virtual = false;
+ }
$path .= $currentFolder;
- if (!isset($arrFolders[$currentFolder]))
- {
- $arrFolders[$currentFolder] = array('id' => $path,
- 'name' => rcube_charset_convert($currentFolder, 'UTF-7'),
- 'folders' => array());
- }
+ if (!isset($arrFolders[$currentFolder])) {
+ $arrFolders[$currentFolder] = array(
+ 'id' => $path,
+ 'name' => rcube_charset_convert($currentFolder, 'UTF-7'),
+ 'virtual' => $virtual,
+ 'folders' => array());
+ }
+ else
+ $arrFolders[$currentFolder]['virtual'] = $virtual;
if (!empty($subFolders))
rcmail_build_folder_tree($arrFolders[$currentFolder]['folders'], $subFolders, $delm, $path.$delm);
- }
+}
/**
* Return html for a structured list <ul> for the mailbox tree
* @access private
*/
-function rcmail_render_folder_tree_html(&$arrFolders, &$mbox_name, $maxlength, $nestLevel=0)
- {
- global $COMM_PATH, $IMAP, $CONFIG, $OUTPUT;
+function rcmail_render_folder_tree_html(&$arrFolders, &$mbox_name, &$jslist, $attrib, $nestLevel=0)
+{
+ global $RCMAIL, $CONFIG;
+
+ $maxlength = intval($attrib['maxlength']);
+ $realnames = (bool)$attrib['realnames'];
+ $msgcounts = $RCMAIL->imap->get_cache('messagecount');
$idx = 0;
$out = '';
- foreach ($arrFolders as $key => $folder)
- {
- $zebra_class = ($nestLevel*$idx)%2 ? 'even' : 'odd';
- $title = '';
+ foreach ($arrFolders as $key => $folder) {
+ $zebra_class = (($nestLevel+1)*$idx) % 2 == 0 ? 'even' : 'odd';
+ $title = null;
- if ($folder_class = rcmail_folder_classname($folder['id']))
+ if (($folder_class = rcmail_folder_classname($folder['id'])) && !$realnames) {
$foldername = rcube_label($folder_class);
- else
- {
+ }
+ else {
$foldername = $folder['name'];
// shorten the folder name to a given length
- if ($maxlength && $maxlength>1)
- {
+ if ($maxlength && $maxlength > 1) {
$fname = abbreviate_string($foldername, $maxlength);
if ($fname != $foldername)
- $title = ' title="'.Q($foldername).'"';
+ $title = $foldername;
$foldername = $fname;
- }
}
+ }
// make folder name safe for ids and class names
- $folder_id = preg_replace('/[^A-Za-z0-9\-_]/', '', $folder['id']);
- $class_name = preg_replace('/[^a-z0-9\-_]/', '', $folder_class ? $folder_class : strtolower($folder['id']));
+ $folder_id = asciiwords($folder['id'], true);
+ $classes = array('mailbox');
// set special class for Sent, Drafts, Trash and Junk
if ($folder['id']==$CONFIG['sent_mbox'])
- $class_name = 'sent';
+ $classes[] = 'sent';
else if ($folder['id']==$CONFIG['drafts_mbox'])
- $class_name = 'drafts';
+ $classes[] = 'drafts';
else if ($folder['id']==$CONFIG['trash_mbox'])
- $class_name = 'trash';
+ $classes[] = 'trash';
else if ($folder['id']==$CONFIG['junk_mbox'])
- $class_name = 'junk';
+ $classes[] = 'junk';
+ else
+ $classes[] = asciiwords($folder_class ? $folder_class : strtolower($folder['id']), true);
+
+ $classes[] = $zebra_class;
+
+ if ($folder['id'] == $mbox_name)
+ $classes[] = 'selected';
- $js_name = htmlspecialchars(JQ($folder['id']));
- $out .= sprintf('<li id="rcmli%s" class="mailbox %s %s%s"><a href="%s"'.
- ' onclick="return %s.command(\'list\',\'%s\',this)"'.
- ' onmouseover="return %s.focus_folder(\'%s\')"' .
- ' onmouseout="return %s.unfocus_folder(\'%s\')"' .
- ' onmouseup="return %s.folder_mouse_up(\'%s\')"%s>%s</a>',
- $folder_id,
- $class_name,
- $zebra_class,
- $folder['id']==$mbox_name ? ' selected' : '',
- Q(rcmail_url('', array('_mbox' => $folder['id']))),
- JS_OBJECT_NAME,
- $js_name,
- JS_OBJECT_NAME,
- $js_name,
- JS_OBJECT_NAME,
- $js_name,
- JS_OBJECT_NAME,
- $js_name,
- $title,
- Q($foldername));
+ $collapsed = preg_match('/&'.rawurlencode($folder['id']).'&/', $RCMAIL->config->get('collapsed_folders'));
+ $unread = $msgcounts ? intval($msgcounts[$folder['id']]['UNSEEN']) : 0;
+
+ if ($folder['virtual'])
+ $classes[] = 'virtual';
+ else if ($unread)
+ $classes[] = 'unread';
- if (!empty($folder['folders']))
- $out .= "\n<ul>\n" . rcmail_render_folder_tree_html($folder['folders'], $mbox_name, $maxlength, $nestLevel+1) . "</ul>\n";
+ $js_name = JQ($folder['id']);
+ $html_name = Q($foldername . ($unread ? " ($unread)" : ''));
+ $link_attrib = $folder['virtual'] ? array() : array(
+ 'href' => rcmail_url('', array('_mbox' => $folder['id'])),
+ 'onclick' => sprintf("return %s.command('list','%s',this)", JS_OBJECT_NAME, $js_name),
+ 'title' => $title,
+ );
+
+ $out .= html::tag('li', array(
+ 'id' => "rcmli".$folder_id,
+ 'class' => join(' ', $classes),
+ 'noclose' => true),
+ html::a($link_attrib, $html_name) .
+ (!empty($folder['folders']) ? html::div(array(
+ 'class' => ($collapsed ? 'collapsed' : 'expanded'),
+ 'style' => "position:absolute",
+ 'onclick' => sprintf("%s.command('collapse-folder', '%s')", JS_OBJECT_NAME, $js_name)
+ ), ' ') : ''));
+
+ $jslist[$folder_id] = array('id' => $folder['id'], 'name' => $foldername, 'virtual' => $folder['virtual']);
+
+ if (!empty($folder['folders'])) {
+ $out .= html::tag('ul', array('style' => ($collapsed ? "display:none;" : null)),
+ rcmail_render_folder_tree_html($folder['folders'], $mbox_name, $jslist, $attrib, $nestLevel+1));
+ }
$out .= "</li>\n";
$idx++;
- }
+ }
return $out;
- }
+}
/**
* Return html for a flat list <select> for the mailbox tree
* @access private
*/
-function rcmail_render_folder_tree_select(&$arrFolders, &$mbox_name, $maxlength, $nestLevel=0, $selected='')
+function rcmail_render_folder_tree_select(&$arrFolders, &$mbox_name, $maxlength, &$select, $realnames=false, $nestLevel=0)
{
- global $IMAP, $OUTPUT;
-
$idx = 0;
$out = '';
foreach ($arrFolders as $key=>$folder)
{
- if ($folder_class = rcmail_folder_classname($folder['id']))
+ if (!$realnames && ($folder_class = rcmail_folder_classname($folder['id'])))
$foldername = rcube_label($folder_class);
else
{
@@ -1080,14 +1138,10 @@
$foldername = abbreviate_string($foldername, $maxlength);
}
- $out .= sprintf('<option value="%s"%s>%s%s</option>'."\n",
- htmlspecialchars($folder['id']),
- ($selected == $foldername ? ' selected="selected"' : ''),
- str_repeat(' ', $nestLevel*4),
- Q($foldername));
+ $select->add(str_repeat(' ', $nestLevel*4) . $foldername, $folder['id']);
if (!empty($folder['folders']))
- $out .= rcmail_render_folder_tree_select($folder['folders'], $mbox_name, $maxlength, $nestLevel+1, $selected);
+ $out .= rcmail_render_folder_tree_select($folder['folders'], $mbox_name, $maxlength, $select, $realnames, $nestLevel+1);
$idx++;
}
--
Gitblit v1.9.1